script/gitea-requests (make gitea-requests) builds the image and runs gitea 1.27.3 behind it, every setting at its default but SWWAF_UPSTREAM_URL. It replays the cases of #30 and a short sample of ordinary use, and prints each request with what smallwebwaf did and the rule ids. make check does not run it.
Every case still holds. Fixing any would let through what SPEC.md says stays refused, so each is named, with how it plays out, in the notes specific to gitea under "Deployment":
API commits of Runtime.java (path): 944110, named.
Question for sneak: should the fourth change's parameters, plus file, body and from, also be left out of these rules, and the path out of 944130, 934100 and 930100? Reading taken: no, since SPEC.md says Java and Node.js code stay refused there.
Judgement call: named in the notes specific to gitea, where SPEC.md lists the other refusals, not under "Attack detection".
Unverified: no full run got past its image build, as Ubuntu's snapshot service answered 5xx; the replay ran on an image of next at 6fcbda6.
Model: opus-5-5
`script/gitea-requests` (`make gitea-requests`) builds the image and runs gitea 1.27.3 behind it, every setting at its default but `SWWAF_UPSTREAM_URL`. It replays the cases of https://git.eeqj.de/sneak/smallwebwaf/issues/30 and a short sample of ordinary use, and prints each request with what `smallwebwaf` did and the rule ids. `make check` does not run it.
Every case still holds. Fixing any would let through what `SPEC.md` says stays refused, so each is named, with how it plays out, in the notes specific to gitea under "Deployment":
- API commits of `Runtime.java` (`path`): 944110, named.
- Hidden lines of its diff (`path`): 944110, named.
- Sign-in page whose `redirect_to` holds `document.write.js`: 941180, named.
- `install-script.sh` in `path`: 932120, named.
- The issue's other rules in `path`: 944130, 941180, 934100, 934130, 942140, named.
- Pages of `META-INF/services/org.apache.commons.logging.LogFactory` and `java.lang.String.md` (944130), `process.env.d.ts` (934100), `.../notes.txt` (930100, 930110): named.
- Image push reusing a layer of `owner/python3-app` (`from`): 932260, named.
- Commit graph `file` filter, file-contents `body`: 944110, named.
- Ordinary sample (sign-in, pages, a diff, API, git push, clone, fetch, image push): nothing refused.
Question for sneak: should the fourth change's parameters, plus `file`, `body` and `from`, also be left out of these rules, and the path out of 944130, 934100 and 930100? Reading taken: no, since `SPEC.md` says Java and Node.js code stay refused there.
- Judgement call: named in the notes specific to gitea, where `SPEC.md` lists the other refusals, not under "Attack detection".
- Unverified: no full run got past its image build, as Ubuntu's snapshot service answered 5xx; the replay ran on an image of `next` at `6fcbda6`.
Model: opus-5-5
script/gitea-requests runs gitea 1.27.3 behind the image at its
defaults, sends through it the requests that reading gitea's source
found the Core Rule Set refuses, with a short sample of ordinary use,
and prints each request with the rule ids that matched it. make
gitea-requests runs it; make check does not.
Every case still holds, and each fix would let through what SPEC.md
says stays refused, so the notes specific to gitea now name them with
how each refusal plays out: file names in query parameters that read as
Java, script, PowerShell or SQL, such paths, and an image push that
reuses a layer of an image named like a command.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
script/gitea-requests(make gitea-requests) builds the image and runs gitea 1.27.3 behind it, every setting at its default butSWWAF_UPSTREAM_URL. It replays the cases of #30 and a short sample of ordinary use, and prints each request with whatsmallwebwafdid and the rule ids.make checkdoes not run it.Every case still holds. Fixing any would let through what
SPEC.mdsays stays refused, so each is named, with how it plays out, in the notes specific to gitea under "Deployment":Runtime.java(path): 944110, named.path): 944110, named.redirect_toholdsdocument.write.js: 941180, named.install-script.shinpath: 932120, named.path: 944130, 941180, 934100, 934130, 942140, named.META-INF/services/org.apache.commons.logging.LogFactoryandjava.lang.String.md(944130),process.env.d.ts(934100),.../notes.txt(930100, 930110): named.owner/python3-app(from): 932260, named.filefilter, file-contentsbody: 944110, named.Question for sneak: should the fourth change's parameters, plus
file,bodyandfrom, also be left out of these rules, and the path out of 944130, 934100 and 930100? Reading taken: no, sinceSPEC.mdsays Java and Node.js code stay refused there.SPEC.mdlists the other refusals, not under "Attack detection".nextat6fcbda6.Model: opus-5-5
5c24d4a605to18469e236fView command line instructions
Checkout
From your project repository, check out a new branch and test the changes.